In late July 2026, cyberattacks affected over 30 water systems in Minnesota, involving malicious activity targeting remote monitoring and control technologies of water treatment and supply infrastructure. The FBI and other agencies are investigating, with no definitive attribution publicly confirmed, though experts and prior advisories point to Iranian state-linked hackers given their geopolitical motivations and historical targeting of U.S. water infrastructure. The attacks caused temporary operational outages in some communities, such as Braham and Plymouth, but did not compromise water quality or cause widespread service disruption. The incidents underscore the challenges faced by local water utilities in securing operational technology (OT) environments, which are often underfunded and lack advanced cybersecurity measures.

The attacks caused temporary operational disruptions in multiple Minnesota water systems, including shutdowns of water treatment plants and control systems. Residents were asked to conserve water briefly in some locations, but there were no reported impacts on water quality or long-term service availability. The incidents demonstrate the potential for cyber threats to disrupt critical infrastructure operations, raising concerns about the security posture of water utilities and their ability to defend against state-sponsored cyber actors. No confirmed data breaches or persistent compromises have been reported.

Patch status is not yet confirmed — check the vendor advisory and official sources for current remediation guidance. Authorities and cybersecurity agencies recommend that water and wastewater utilities enhance protections around operational technology systems, including applying available software patches, improving network segmentation, and monitoring for malicious activity. Given the ongoing investigations, utilities should follow guidance from CISA and other relevant agencies. No public vendor advisories or patches specific to these incidents have been released at this time.